Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...d7.exe

windows7-x64

10

JaffaCakes...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3701baa7bad5238b077f127902c7c6d7

  • Size

    156KB

  • Sample

    250301-f4nyessmy3

  • MD5

    3701baa7bad5238b077f127902c7c6d7

  • SHA1

    76bc86e327138565391e7910de0d0487185de57e

  • SHA256

    6f9c0e5a3b240e1be906540b8eb05f8b811800e3f115d592af13553cd38ab5f2

  • SHA512

    074064f24b0e0450fef32db8ec53d947f298b2d204ac15e2b368e19e758b42c247c6b25586ecbd3ccc28d3ccefbe0d1964cac4ad1d18c2d7708d423e7293acf5

  • SSDEEP

    3072:uo0IpeXWit3BHgqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1L:u1weGEWkibRG9dPigz60F11Vriuex1L

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_3701baa7bad5238b077f127902c7c6d7

    • Size

      156KB

    • MD5

      3701baa7bad5238b077f127902c7c6d7

    • SHA1

      76bc86e327138565391e7910de0d0487185de57e

    • SHA256

      6f9c0e5a3b240e1be906540b8eb05f8b811800e3f115d592af13553cd38ab5f2

    • SHA512

      074064f24b0e0450fef32db8ec53d947f298b2d204ac15e2b368e19e758b42c247c6b25586ecbd3ccc28d3ccefbe0d1964cac4ad1d18c2d7708d423e7293acf5

    • SSDEEP

      3072:uo0IpeXWit3BHgqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1L:u1weGEWkibRG9dPigz60F11Vriuex1L

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks